S1 Settings

We make use of three datasets, namely CIFAR-10, BOSS1.0.1, and ImageNet for the evaluation. CIFAR-10 and ImageNet are

widely used for various vision-related tasks and BOSS1.0.1 is the dataset commonly covered by the stenography fields. For the

overall experiments, for CIFAR-10, we utilize its training dataset for training and the testing dataset for testing. In the case of

BOSS1.0.1, it contains 10,000 images in total. We split the dataset into two: 9,000 for training and 1,000 for testing. In the case

of ImageNet, for all experiments including PixelCNN++ training, we utilize its training dataset for training and its validation

dataset for testing. We use 32 × 32 × 3 for CIFAR-10, 128 × 128 × 1 for Boss-1.0.1 dataset, and 64 × 64 × 3 for ImageNet. For

experimental settings, we spend approximately 1 week to train a PixelCNN++ model for each dataset using four NVIDIA P100

GPUs. For training Deep Steganography and ISGAN, we need less than 3h for each case on one NVIDIA GTX 1080 GPU. In

we evaluate its effect on the decoded secret image by measuring the residual between the secret image decoded by unmodified

stego image and randomly modified stego image, respectively. An increase by 1 in any position in any color channel of the

stego image has an impact across all color channels in the decoded secret image. We see that the largest impact commonly

occurs on the same channel.

We also witness that the secret image is encoded in a distributive but location-limited way. In other words, the pixel in-

formation of the left top corner of the secret image is only encoded on the left top corner of the cover image and likewise

for other areas. Based on this finding, we confirm that active steganalysis algorithms adjusting the stego image generated by

the deep learning-based encoding algorithms should apply the alternation of all the pixels of the stego image for the definitive

steganography removal.

Figure S1: Impact of increasing a pixel value of the stego image by 1 on the decoded secret image. The left side of the figure is the residual

on each RGB channel between the stego image and modified stego image. The right side of the figure is the residual on each RGB channel

between the secret images decoded by the stego image and modified stego image, respectively.

S3 Destruction Rate

Table S1: The average of decoded rate (DC) and destruction rate (DT) of Deep Steganography on each dataset.

Table S2: The average of decoded rate (DC) and destruction rate (DT) of ISGAN on each dataset.

Table S3: The average of decoded rate (DC) and destruction rate (DT) of LSB on each dataset.

S4 Experimental Results on Original Images

Figure S2

S5 Experimental Results on ImageNet

Figure S3

S6 Experimental Results on BOSS1.0.1

Figure S4

S7 Comparison between an Edge Detector and the Neural Network

S8 Denoising and Restoration

Figure S6: The effect of denoising and restoration (Deep Steganography on ImageNet). S

= stego image, D

= decoded secret image, S

= stego image modified by median filter, D

= secret image decoded from S

, S

= stego image modified by wiener restoration, and D

=

secret image decoded from S

Figure S7: The effect of denoising and restoration (ISGAN on ImageNet). S

= stego image

S9 Ablation Study Examples

Table S4: Ablation results of our proposed methods. DC = decoded rate, and DT = destruction rate. In the case of PSNR, SSIM and DA, the

larger the value, the better. DC is the opposite.

 PSNR SSIM DC DT

1 35.66 0.9834 0.7761 0.2117

Our Method w/o

Edge Detection

2 35.72 0.9837 0.7523 0.2365

4 35.39 0.9811 0.7375 0.2720

1 35.89 0.9839 0.7691 0.2184

Figure S8: Ablation study: no edge detection examples (Deep Steganography on ImageNet). S

= decoded secret image,

S

= stego image modified by our method but without an edge condition, D

= secret image decoded from S

, S

=

stego image modified by our method with an edge condition, and D

= secret image decoded from S

S10 Comparison at the Same Decoded Rate

efficiency at the same decoded rate in Fig. S9 and S10 as described in Sec. 5.1.

by our method, and D

= secret image decoded from S

Figure S10: Comparison of the image quality of the stego image modified by our method with that of the stego image modified by Gaussian

noise when the decoded rate between the two secret images is the almost same (ISGAN on ImageNet). S

= stego image, D

secret image, S

= stego image modified by our

S11 Comparison at the Same PSNR

method, Gaussian noise, differ in the efficiency at the same PSNR for all the given cases as described in Sec. 5.1 and Fig. 4.